From 5a839f8363b548107188b8d3d0426ff883c809ce Mon Sep 17 00:00:00 2001 From: ClydeW Date: Thu, 20 Aug 2026 13:11:35 +0200 Subject: [PATCH 1/2] Document AKS internal CIDR ranges to avoid for VNet peering (MXFORAZURE-549) --- .../deployment/mx-azure/configuration/_index.md | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/content/en/docs/deployment/mx-azure/configuration/_index.md b/content/en/docs/deployment/mx-azure/configuration/_index.md index dab3f11b7aa..2dbdc7de2f0 100644 --- a/content/en/docs/deployment/mx-azure/configuration/_index.md +++ b/content/en/docs/deployment/mx-azure/configuration/_index.md @@ -28,9 +28,20 @@ The [Mendix on Azure Portal](https://mendixonazure.mendix.com) provides a variet | Advanced Option | Description | Editable after initial creation | | --- | --- | --- | | Load Balancer Type | Controls whether your applications are reachable publicly or only privately via your own (Virtual) Network or Private Endpoints. | Yes | -| AKS Node CIDR IP Range | Defines the IP address range on the VNet hosting AKS cluster nodes. This can only be set during initial deployment and should align with your organization's IP plan if you plan to connect Mendix on Azure to other networks via peering. Default is acceptable when no interconnection is required. | No | +| AKS Node CIDR IP Range | Defines the IP address range on the VNet hosting AKS cluster nodes. This can only be set during initial deployment and should align with your organization's IP plan if you plan to connect Mendix on Azure to other networks via peering. Default is acceptable when no interconnection is required. Do not use a range that overlaps 10.0.0.0/16 or 10.244.0.0/16: these are reserved for internal AKS traffic on every Mendix on Azure cluster and are not configurable. If overlap cannot be avoided, use Private Endpoints. | No | | AKS Network Isolated Cluster | When set to true will lead to a cluster without egress configuration, please carefully read the [documentation on cluster networking modes](/developerportal/deploy/mendix-on-azure/configuration/ingress-egress/) to understand the implications | No | +{{% alert color="warning" %}} +Every Mendix on Azure cluster uses the AKS default internal address ranges `10.0.0.0/16` (Kubernetes service CIDR) and `10.244.0.0/16` (pod CIDR). These ranges are not part of the VNet that Mendix creates, and they are not configurable. + +Because of this: + +* Do not set an *AKS Node CIDR IP Range* that overlaps `10.0.0.0/16` or `10.244.0.0/16`. Azure rejects cluster creation when the service CIDR overlaps a subnet that the cluster can route to. +* Do not route networks that overlap `10.0.0.0/16` or `10.244.0.0/16` to the cluster through VNet peering, a VPN, or ExpressRoute. Traffic to addresses in those ranges is resolved inside the cluster and does not reach the remote network. + +If your IP plan uses `10.0.0.0/8`, choose a node CIDR range outside these two ranges and confirm that the on-premises and peered ranges you want to reach from Mendix on Azure do not overlap them either. If overlap cannot be avoided, use Private Endpoints to reach the services in the overlapping network, as Private Endpoints do not require peering or routing between the overlapping ranges. +{{% /alert %}} + For more information, see [Configuring Ingress and Egress](/developerportal/deploy/mendix-on-azure/configuration/ingress-egress/). ### Application Cluster Settings From 523d2043b5595cd45aeb0c8d9986fea91a3a585f Mon Sep 17 00:00:00 2001 From: katarzyna-koltun-mx <108737161+katarzyna-koltun-mx@users.noreply.github.com> Date: Thu, 20 Aug 2026 14:22:31 +0200 Subject: [PATCH 2/2] Update _index.md --- content/en/docs/deployment/mx-azure/configuration/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/docs/deployment/mx-azure/configuration/_index.md b/content/en/docs/deployment/mx-azure/configuration/_index.md index 2dbdc7de2f0..adf7282bd15 100644 --- a/content/en/docs/deployment/mx-azure/configuration/_index.md +++ b/content/en/docs/deployment/mx-azure/configuration/_index.md @@ -36,8 +36,8 @@ Every Mendix on Azure cluster uses the AKS default internal address ranges `10.0 Because of this: -* Do not set an *AKS Node CIDR IP Range* that overlaps `10.0.0.0/16` or `10.244.0.0/16`. Azure rejects cluster creation when the service CIDR overlaps a subnet that the cluster can route to. -* Do not route networks that overlap `10.0.0.0/16` or `10.244.0.0/16` to the cluster through VNet peering, a VPN, or ExpressRoute. Traffic to addresses in those ranges is resolved inside the cluster and does not reach the remote network. +* Do not set an *AKS Node CIDR IP Range* that overlaps with `10.0.0.0/16` or `10.244.0.0/16`. Azure rejects cluster creation when the service CIDR overlaps a subnet to which the cluster can route. +* Do not route networks that overlap with `10.0.0.0/16` or `10.244.0.0/16` to the cluster through VNet peering, a VPN, or ExpressRoute. Traffic to addresses in those ranges is resolved inside the cluster and does not reach the remote network. If your IP plan uses `10.0.0.0/8`, choose a node CIDR range outside these two ranges and confirm that the on-premises and peered ranges you want to reach from Mendix on Azure do not overlap them either. If overlap cannot be avoided, use Private Endpoints to reach the services in the overlapping network, as Private Endpoints do not require peering or routing between the overlapping ranges. {{% /alert %}}